Security in a containerized world
summary
Focus is runtime hardening: concrete changes landing in Kubernetes and Docker rather than abstract best practices. Announces default seccomp whitelist for containers, no_new_privs enabled by default in Kubernetes 1.8, and pod security policies to enforce nonroot and read‑only roots. Shows a setuid binary breaking under no_new_privs, explains namespaces vs cgroups, and recommends AppArmor/SELinux labels and network policies with a default‑deny plus explicit whitelists for pod communication.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:43History of Containers in Paris
- 1:58Designing the Security Model for Kubernetes
- 2:29Cooperative Soft Multi-Tenancy
- 4:55Runtime Security
- 6:02The Chrome Sandbox
- 8:44Things To Remember about Namespaces
- 12:54No New Privileges
- 17:12Network Policies
related talks
05mContainer Security Best Practices
50mThe state of container security
38mContainer Security, capabilities an seccomp profiles
46mSecuring Applications and Pipelines on a Container Platform
33mKubernetes Security Jumpstart
28mContainer Security: A Horror Story
37mIt’s 2018; Are My Containers Secure Yet?!
26mSecure Containers Deployments: Time for Refresh